Featured
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
Teams Threat Protection: What Actually Changed and What You Can Actually Hunt
Threat Analytics in Microsoft Defender: What It Actually Does and Why Your SOC Needs It
Hunting in Microsoft Sentinel: What Hunting Actually Is and Why You Need It
Three Essential Sentinel Workbooks You Should Deploy Right Now
Sentinel Workbooks: Deploy and Customise Your First Dashboard
Beauty of Data Visualization in Microsoft Sentinel Using KQL
Microsoft's Defaults: Five Settings You Need to Fix Right Now
Defender for Office 365 Policy Configuration: Anti-Phishing, Anti-Spam, Malware, Safe Links
Is Defender for Office 365 worth it?
UEBA in Microsoft Sentinel: Stop Wasting Time on Behavioral Analytics
Fixing Microsoft's Azure Brute Force Detection: Why Their Template Fires Constantly (And What You Should Change)
Building a Brute Force Detection Query: How To Think Through Network Logon Failures
Attack Simulation Training in Microsoft Defender for Office 365
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
Advanced Hunting
Alert Tuning
Analytic Rules
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
-
Beyond the Basics: Forging Your Own Custom Detections in Defender XDR
-
The KQL Playbook (Play #2): Mastering the Matching Game
-
Fixing Microsoft's Azure Brute Force Detection: Why Their Template Fires Constantly (And What You Should Change)
App Governance
Attack Path Analysis
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
Automation
-
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
-
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
Microsoft Sentinel Rule Tuning: Kick the Noise, Keep the Signal
-
Herding Cats with Sentinel: An In-Depth Guide to Workspace Manager
AWS Security
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Azure
Azure Arc
Azure Security
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Career Advice
-
How to Nail Your First SOC Analyst Interview (Professor's Notes)
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
CASB
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
Cheatsheet
Cloud Compliance
Cost Optimisation
-
Sentinel on a Budget: How to Tame Your Log Costs
-
Sentinel's Endgame Gear: Sentinel Data Lake
-
Sentinel's Built-in Consultant: An In-Depth Guide to SOC Optimization
-
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
Data Connectors
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
Defender for Office 365
-
Attack Simulation Training in Microsoft Defender for Office 365
-
Is Defender for Office 365 worth it?
-
Defender for Office 365 Policy Configuration: Anti-Phishing, Anti-Spam, Malware, Safe Links
Defender XDR
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
-
Defender for Office 365 Policy Configuration: Anti-Phishing, Anti-Spam, Malware, Safe Links
-
Threat Analytics in Microsoft Defender: What It Actually Does and Why Your SOC Needs It
GCP Security
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Getting Started
-
How to create Microsoft Sentinel
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
The KQL Playbook (Play #2): Mastering the Matching Game
Incident Response
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
-
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
-
Beyond the Basics: Forging Your Own Custom Detections in Defender XDR
Insider Risk
-
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
-
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
Interview Prep
-
How to Nail Your First SOC Analyst Interview (Professor's Notes)
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
KQL
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
The KQL Playbook (Play #1): A Beginner's Guide to Talking to Your Data
-
Microsoft Sentinel's Secret Weapon: Your First Watchlist
-
Microsoft Sentinel Rule Tuning: Kick the Noise, Keep the Signal
KQL Playbook
-
The KQL Playbook (Play #4): The Correlation Play - Joining Tables and Enriching Data
-
The KQL Playbook (Play #5): The Anomaly Play - Finding the 'Weird'
-
The KQL User Audit Playbook: Your Template for Investigations
-
Teams Threat Protection: What Actually Changed and What You Can Actually Hunt
-
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
Learning KQL
-
Building a Brute Force Detection Query: How To Think Through Network Logon Failures
-
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
Logic Apps
-
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
-
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
-
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
MDCA
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
Mastering Policies in Defender for Cloud Apps: A Deep Dive for the SOC Trenches
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
Microsoft Defender for Cloud Apps
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
Mastering Policies in Defender for Cloud Apps: A Deep Dive for the SOC Trenches
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Microsoft Sentinel
-
How to create Microsoft Sentinel
-
A Day in the Life of a SOC Analyst
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
Microsoft Teams
MSSP
-
A Day in the Life of a SOC Analyst
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
OAuth Security
Phishing
Playbook
PowerShell
-
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
Rule Tuning
Security Operations
-
A Day in the Life of a SOC Analyst
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
-
The KQL Playbook (Play #2): Mastering the Matching Game
-
The KQL Playbook (Play #5): The Anomaly Play - Finding the 'Weird'
Sentinel Tuning
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
-
Beauty of Data Visualization in Microsoft Sentinel Using KQL
Sentinel Workbook
-
Sentinel Workbooks: Deploy and Customise Your First Dashboard
-
Three Essential Sentinel Workbooks You Should Deploy Right Now
-
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
Shadow IT
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
SOC
-
How to Nail Your First SOC Analyst Interview (Professor's Notes)
-
A Day in the Life of a SOC Analyst
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
SOC Operations
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
-
Attack Simulation Training in Microsoft Defender for Office 365
-
Building a Brute Force Detection Query: How To Think Through Network Logon Failures
-
Is Defender for Office 365 worth it?
Threat Hunting
-
The KQL Playbook (Play #1): A Beginner's Guide to Talking to Your Data
-
Sentinel's Endgame Gear: Sentinel Data Lake
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
-
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
-
The KQL Playbook (Play #3): Mastering Strings, Timestamps, and Ugly JSON
UEBA
Watchlist
-
Microsoft Sentinel's Secret Weapon: Your First Watchlist
-
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
Workbooks
-
Sentinel Workbooks: Deploy and Customise Your First Dashboard
-
Three Essential Sentinel Workbooks You Should Deploy Right Now
-
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds